Analysis
-
max time kernel
122s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
13-10-2023 04:53
Static task
static1
Behavioral task
behavioral1
Sample
6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe
Resource
win10v2004-20230915-en
General
-
Target
6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe
-
Size
1.4MB
-
MD5
86d7f19f16003c2e94d98b0465becd8a
-
SHA1
d8f436419da4455ca6482d0e0c4be42912fe9843
-
SHA256
6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25
-
SHA512
8f18b6e70a6751d5f86be22b8629e196b4f7a1dd9b84d93c0ef4d14c1e094a1788da10e3b5ce1cb9be9aa17b7065719a66bf9c4341befc4798acdb632dfbbc01
-
SSDEEP
24576:b8zXcqZ1zuNWvycWBynTOUCR2pRyHZlcE2cWLWh5ZwiWjiA6bfOQIk0j+t4RXtAJ:wzXc2sNIXDRyHDcPcWSHuilZVIk0j+yM
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exedescription pid process target process PID 2472 set thread context of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2636 1332 WerFault.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exeAppLaunch.exedescription pid process target process PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 2472 wrote to memory of 1332 2472 6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe AppLaunch.exe PID 1332 wrote to memory of 2636 1332 AppLaunch.exe WerFault.exe PID 1332 wrote to memory of 2636 1332 AppLaunch.exe WerFault.exe PID 1332 wrote to memory of 2636 1332 AppLaunch.exe WerFault.exe PID 1332 wrote to memory of 2636 1332 AppLaunch.exe WerFault.exe PID 1332 wrote to memory of 2636 1332 AppLaunch.exe WerFault.exe PID 1332 wrote to memory of 2636 1332 AppLaunch.exe WerFault.exe PID 1332 wrote to memory of 2636 1332 AppLaunch.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe"C:\Users\Admin\AppData\Local\Temp\6805b24478a852eed31a44b83904940f74ec68d724b4e927146fbff543833c25.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1332 -s 2003⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1332-0-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/1332-1-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/1332-2-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/1332-3-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/1332-4-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/1332-7-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/1332-5-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/1332-6-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1332-9-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB
-
memory/1332-11-0x0000000000400000-0x0000000000532000-memory.dmpFilesize
1.2MB